IngeHack: EDR Evasion

An Active Directory series from IngeHack. The chain is built around a Windows environment with Defender active — meaning before you can do anything meaningful, you have to get your tooling past it. That was the first challenge, and the one this writeup covers for now.

The approach was modifying GodPotato to strip or replace the signatures that Defender flags, combined with techniques for building custom versions of common tools that don’t carry recognizable bytecode patterns. The two resources below were the most useful references for this:

• Modifying GodPotato to Evade Antivirus
• Custom Tools Antivirus Bypass

To be continued.